Hidden Oracles Catch AI C++ Patches That Only Pass the Tests You Showed

A queue maintainer handed a coding model a broken bounded integer ring and three unit tests. The prompt showed capacities 8, 16, and 32. The returned patch compiled, linked, and turned every visible assertion green. Two days later a production producer used capacity 10 and a head index near 2^32. The wrap path the model had specialized to power-of-two sizes dropped an element with no exception and no log line.

Visible tests are a hint. They are not a specification. A model that can read the prompt can memorize the hint. The rest of this article treats that failure as a grading problem, not a vibes problem, and walks through a two-layer harness a C++ team can run on every generated patch.

Why a green demo still ships silent damage

Coding models optimize for the text in front of them. If the only executable contract in the prompt is tests/visible.cpp, a plausible strategy is to special-case those inputs. The compiler will not object. A human skim of a 20-line diff often will not object either.

That is a different bug class from a patch that fails to build. It is also different from a patch that deletes a mutex. Overfit code still looks careful. It copies the house style. It adds comments that restate the three tests. The defect lives in the cases nobody pasted into the chat.

Agent-style coding loops make the pattern cheaper to repeat. Each retry can grope toward the visible file. Without a second oracle the loop calls that progress. Technical debt then arrives as a passing suite, not as a red CI job.

Two layers, one patch, three exit codes

The harness below keeps two test binaries that share one implementation.

1. Visible tests may be quoted in the prompt. They document the bug the model is asked to fix.
2. Hidden oracles never appear in the prompt. They vary capacity, fill level, wrap, and sanitizer-visible undefined behavior.
3. The grader applies a unified diff, builds both binaries, and maps outcomes to a small fail taxonomy.

A patch is accepted only when both binaries pass under AddressSanitizer and UndefinedBehaviorSanitizer. A patch that greens the demo and reds the oracle is scored OVERFIT, not PASS. That single label is the point of the artifact.

The layout is boring on purpose.

eval_hidden_oracle/
  include/bounded_queue.hpp
  src/bounded_queue.cpp
  tests/visible.cpp
  oracles/hidden.cpp
  prompts/fix_queue.md
  patches/
  scripts/grade.sh
  manifest.json

manifest.json binds a prompt file to the two binaries so a later prompt edit cannot silently drop the hidden target.

{
  "id": "bounded-queue-v3",
  "prompt": "prompts/fix_queue.md",
  "sources": ["include/bounded_queue.hpp", "src/bounded_queue.cpp"],
  "visible": "tests/visible.cpp",
  "hidden": "oracles/hidden.cpp",
  "cxxflags": ["-std=c++17", "-fsanitize=address,undefined", "-fno-omit-frame-pointer"]
}

The worked example below is a fixture, not a production benchmark. No pass-rate is claimed.

The bug the prompt is allowed to describe

The header is small enough to paste. The defect is a classic full/empty collision plus a power-of-two wrap.

#pragma once
#include <cstddef>
#include <cstdint>
#include <optional>

class BoundedQueue {
public:
  explicit BoundedQueue(std::size_t cap);
  bool push(std::int32_t v);
  std::optional<std::int32_t> pop();
  std::size_t size() const;
  std::size_t capacity() const { return cap_; }

private:
  std::size_t cap_;
  std::size_t head_ = 0;
  std::size_t tail_ = 0;
  std::size_t count_ = 0;
  std::int32_t* buf_;
};

A broken implementation that still satisfies naive tests might mask indices with cap_ - 1 even when cap_ is not a power of two, and might treat head_ == tail_ as empty while also using that condition for full. Visible tests that only push three items into size 8 will not see it.

bool BoundedQueue::push(std::int32_t v) {
  if (count_ == cap_) return false;
  buf_[tail_ & (cap_ - 1)] = v; // wrong when cap_ is not 2^n
  tail_++;
  count_++;
  return true;
}

Step 1 — Write visible tests the prompt may include

Keep this file honest and small. It should fail on the broken code. It should not enumerate the interesting capacities.

#include "bounded_queue.hpp"
#include <cassert>

int main() {
  BoundedQueue q(8);
  assert(q.push(1));
  assert(q.push(2));
  assert(q.push(3));
  assert(q.size() == 3);
  assert(q.pop() == 1);
  assert(q.pop() == 2);
  assert(q.size() == 1);
  return 0;
}

The prompt then states the symptom in engineering language: push reports success but a later pop misses values when the queue is reused. It must not paste oracles/hidden.cpp.

Step 2 — Hide property checks the model does not get to read

The oracle file is the actual grader. It walks capacities that are not powers of two, fills to the last slot, wraps head and tail past 2^16, and checks FIFO order. It also asks ASan to notice an out-of-bounds index.

#include "bounded_queue.hpp"
#include <cassert>
#include <cstdint>
#include <vector>

static void roundtrip(std::size_t cap, int cycles) {
  BoundedQueue q(cap);
  std::vector<std::int32_t> want;
  for (int i = 0; i < static_cast<int>(cap); ++i) {
    assert(q.push(i));
    want.push_back(i);
  }
  assert(!q.push(999));
  for (int c = 0; c < cycles; ++c) {
    for (std::int32_t v : want) {
      auto got = q.pop();
      assert(got.has_value());
      assert(*got == v);
      assert(q.push(v));
    }
  }
  assert(q.size() == cap);
}

int main() {
  for (std::size_t cap : {1u, 2u, 3u, 5u, 7u, 10u, 15u}) {
    roundtrip(cap, 4);
  }
  BoundedQueue long_run(10);
  for (int i = 0; i < 10000; ++i) {
    assert(long_run.push(i));
    auto v = long_run.pop();
    assert(v.has_value());
    assert(*v == i);
  }
  return 0;
}

Those cases are cheap. They are also exactly the inputs a model will not hard-code if it never saw them. If a later author copies this file into the prompt, the harness is compromised and the OVERFIT label stops meaning anything.

Step 3 — Grade the diff, not the chat transcript

scripts/grade.sh is the reproducible core. It copies sources to a work tree, applies one unified diff, builds two binaries, and prints a single token the rest of a pipeline can parse.

#!/usr/bin/env bash
set -euo pipefail
ROOT=$(cd "$(dirname "$0")/.." && pwd)
PATCH=${1:?usage: grade.sh patches/foo.diff}
WORK=$(mktemp -d)
trap 'rm -rf "$WORK"' EXIT

cp -R "$ROOT/include" "$ROOT/src" "$ROOT/tests" "$ROOT/oracles" "$WORK/"
(cd "$WORK" && patch -p1 < "$PATCH")

CXXFLAGS=(-std=c++17 -O1 -g -fsanitize=address,undefined -fno-omit-frame-pointer -Iinclude)

visible_status=0
hidden_status=0
g++ "${CXXFLAGS[@]}" -o "$WORK/visible" src/bounded_queue.cpp tests/visible.cpp \
  && "$WORK/visible" || visible_status=$?
g++ "${CXXFLAGS[@]}" -o "$WORK/hidden" src/bounded_queue.cpp oracles/hidden.cpp \
  && "$WORK/hidden" || hidden_status=$?

if [[ $visible_status -ne 0 && $hidden_status -ne 0 ]]; then echo FAIL_BOTH; exit 2; fi
if [[ $visible_status -ne 0 ]]; then echo FAIL_VISIBLE; exit 3; fi
if [[ $hidden_status -ne 0 ]]; then echo OVERFIT; exit 4; fi
echo PASS

Run it on a known-bad patch first. A harness that cannot fail is not a harness.

chmod +x scripts/grade.sh
# labeled example: apply a recorded overfit diff
./scripts/grade.sh patches/power_of_two_mask.diff
# expected line: OVERFIT

Keep a second recorded diff that actually uses count_ and % cap_ (or a growable index into a std::vector). That file should print PASS. If both diffs print PASS, the hidden oracle is too weak.

Step 4 — Record fail modes instead of a single score

A numeric “quality” score hides the decision. The table is the artifact the team can argue about.

Visible	Hidden	Label	Typical cause
fail	fail	FAIL_BOTH	patch missed the bug, or broke compilation
fail	pass	FAIL_VISIBLE	rare; oracle weaker than the demo, fix the oracle
pass	fail	OVERFIT	special-cased prompt tests, wrong wrap, dropped invariant
pass	pass	PASS	candidate for human review, not an auto-merge

FAIL_VISIBLE with a green hidden binary is a harness bug. Stop generating patches and repair the oracle. OVERFIT is the label this article exists to make cheap to produce. PASS still needs a reviewer. Sanitizers catch a slice of undefined behavior. They do not catch a wrong API shape.

Step 5 — Spend free codegen trials on the loop, not on the grader

The grader is local g++ plus two binaries. The model is the only part that needs a remote coding endpoint. Repeated retries are where token budget actually matters, because each failed OVERFIT should feed a new attempt with the visible tests unchanged and the hidden file still hidden.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode is an open-source coding project that, per the operator, offers free model access on the order of 10 million tokens and a free server option. Those two availability claims are the only product facts used here. No model names, hardware, quota clocks, or accuracy numbers are attached, because those change and this article does not re-measure them.

A practical split looks like this. The prompt and visible tests go to the coding server. The patch comes back as a diff. grade.sh runs on the maintainer’s machine or in ordinary CI. If the label is OVERFIT, the next prompt may say the visible tests must keep passing and that wrap must work for non-power-of-two capacities, without ever attaching oracles/hidden.cpp. The hidden file remains the judge, not the lesson.

Readers who already keep a C++ golden-case folder can point that same grader at patches from a free coding server instead of pasting diffs by hand.

What this method refuses to claim

Hidden oracles are still finite. A queue that passes capacities {1,2,3,5,7,10,15} can fail at 64 KiB or under a concurrent producer the fixture never starts. The harness does not replace thread-safety review, ABI review, or a design discussion about whether a ring buffer was the right object.

Do not leak the oracle. Once hidden cases appear in the prompt, the model can overfit the second file and the taxonomy collapses to “both tests were in the chat.” Treat oracle leakage like test-gold leakage in a programming contest.

Do not run untrusted generated patches unsandboxed on a laptop that mounts secrets. ASan is not a jail. Apply diffs inside a throwaway directory or container. The script above uses mktemp; that is a start, not a security boundary for hostile input.

Do not auto-merge on PASS. The label means “the cases we bothered to hide did not fail.” Cheap code still accumulates debt when the oracle lags the product.

Who should skip this harness

Skip it when the change is a comment-only edit or a build-system tweak with no runtime. Skip it when there is no compiler toolchain and no way to run sanitizers. Skip it when the specification is interactive UI with no executable property. Skip it when the team will paste the hidden file into every prompt “to help the model.” At that point the second layer is theatre.

Teams that already grade only with the compiler are not done. Compile-clean overfit is the case this fixture is built to name. Teams that already maintain a large property-based suite can swap oracles/hidden.cpp for that suite and keep the same exit taxonomy. The structure travels. The ring buffer does not have to.

The maintainer in the opening scene did not need a larger model. They needed a test the model was not allowed to read. Once that file exists, every later prompt change, server change, or retry policy can be scored with the same three tokens: FAIL_BOTH, OVERFIT, PASS. The demo can stay green. The oracle still gets a vote.