TL;DR

Our alignment practice is based on a shortcut: whenever capabilities generalize further than alignment, we correct the mismatch by giving samples of the new capability. I propose to perform Ironman Runs on previous benchmarks: achieving competitive scores without samples from the new domain. This forces us to design new alignment techniques and to consider failure points from first principles. I identified a failure point that was previously neglected, and devised an approach based on Dispositions/Shard Theory. This allowed me to achieve top-5 scores on refusal in old agentic and code benchmarks at my first targeted attempt, with a Hermes-3 (8b instruct model without refusal training), 45 minutes of H100 and without a single agentic or code sample. All I needed was a prefill and SFT samples.

The specific technique might or might not have a long life, but the Ironman approach works.

A general approach

One of the central worries of AI Safety is that capabilities might generalize further than alignment, either as a general rule or after a capability explosion. Since models can be dangerous during training, this implies the existence of risk windows between the emergence of a capability and the moment when it's rendered safe. More subtly, if our alignment techniques require dedicated training around a capability, they might only work if we can detect and elicit those capabilities, which is not robust against sandbagging and other types of alignment faking.

A robust solution to the alignment problem would be one where we don't need to detect new capabilities, or conduct dedicated training to address them. "Alignment by default" is, arguably, the belief that this was achieved by RLHF over chat data.

This belief is false. The clearest evidence came from the chat-agent gap. LLMs complied with agentic tasks more often than with dangerous chat requests, even after dedicated training. We can see this in multiple benchmarks. At the time of publication:

• AgentHarm measured a gap of 7–23 points between chat and agent versions of the same tasks
• BrowserART measured a gap of 23–62 points between chat and browser-agent versions of the same tasks
• Agent-SafetyBench measured a gap of 10–56 points between harmful-content vs. tool-action tasks

But this wasn't a one-time gap.

• It happened with code: CodeAttack took GPT-4 and Claude-2 from 0% harmful compliance to 81–84% when the request was written as a code-completion task. RMCBench measured an average refusal gap of 49 points between malicious-code requests vs malicious-code completion.
• It happened with image recognition: FigStep measured a 38 percentage points gap between a chat request and the same request printed in an image. (There are multiple examples of 90-100% harmful compliance with images,but we need to take into account that multi-modality gives continuous access to latent space: images can be adversarially optimized like a soft prompt).
• It happened with languages: translating requests into uncommon languages such as Zulu or Scottish Gaelic took GPT-4 from 1% harmful compliance to 79% (Yong et al., 2023).
• It happened with grammatical tenses: harmful requests in the past tense raised compliance by 27- 87 points (Andriushchenko & Flammarion, 2024).
• And it's starting to happen with real-world interactions: GPT-6 Astra refused only 3% of RoboHarm, while Fable 5.1 refused 20% (only the stabbing requests). In BadRobot, GPT-4-turbo carried out 23% of malicious requests and 69% under attack. Models often refused in their text reply while still performing the malicious action.

Some of these issues definitely got better, but it's not clear if it was a mere matter of scaling (maybe old LLMs were too dumb to recognize harm on new domains) or of dedicated training on new samples. But the general issue is clear. Wei et al. (2023) called it "mismatched generalization". But if you have been in the space for long, you will recognize these as low-stakes variants of the MIRI posture: "capabilities generalize further than alignment once capabilities start generalizing far". This was usually understood as a catastrophic event, after a model started behaving like, e.g, an expected utility maximizer (or whatever turns out to be the optimal under Decision Theory) and started scheming. But that could be a particularly dramatic instance of a more general phenomenon. There are boundaries that capabilities can cross without alignment immediately following.

There are two ways to address the question of alignment generalization. The first way requires thinking in terms of algorithmic biases: the simplicity prior, the speed prior and multiple forms of path-dependence. Fundamentally, if you have possibility X (a safe algorithm) and possibility Y (an unsafe algorithm), you might be able to predict in advance which one ends up implemented based on speed/complexity/preexisting primitives and the general bias of the network. This sounds promising, but it remains mostly theoretical: the best we can say is that the weight decay of AdamW and the convergence of gradients in grokking might put some pressure towards simplicity, that functionalities implemented with building blocks can generalize explosively after a new primitive violates a previously universal invariant, that representations tend to be factored and composable, and that Decision Theory optimals might be simple.

(There could be additional simplicity pressures. For example: feature directions only interfere with each other when they are active, but any sort of rule embedded in the weights that maps features to features (e.g: "harm" to "refusal") interferes with every other rule that doesn't sit beyond a non-linearity. This puts a limit on the amount of simultaneous rules a model can hold. However, some rules can make use of the geometry of the latent space to become reusable: e.g, if gender and plurals sit in a parallelogram, moving from queen -> king -> kings is the same operation as moving from girl -> boy -> boys. A single reusable rule could free thousands of rule slots by replacing lookups. Is rule interference a tragedy of the commons, or can it constitute additional pressure towards generality? As far as I'm aware, there is no empirical answer yet to this question. I tried to measure it in a toy model, and it was mostly a tragedy of the commons, with reusable rules being disproportionately preserved compared to lookups. However, toy models are rarely representative of LLMs: the embedding space of LLMs is usually quite well-ordered, and I got mostly random orderings with synthetic data.)

But we have another avenue. We can consider this as a practical problem. If we have identified a previous boundary, we can use it as a lab: we can see what are the failure points and if it's possible to address them in advance, before a regime change. We might not be able to predict all novel problems of future boundaries, but at least we could stop falling in the exact same trap twice. It's easy to create benchmarks around a boundary crossing, and measurable benchmarks usually bring rapid innovation. For this reason, I propose the following type of test:

"Can you saturate agentic harm benchmarks without training on agentic examples?"

If you cannot, your techniques might not hold for future boundaries: we would have to rely on you catching and defanging novel capabilities. A continuous failure on this test would give us a strong clue on the difficulty of robust alignment. If you succeed, you can check against other boundaries: if you are still able to preserve previous alignment through them, you might have found a general technique.

Why does this excite me? Fundamentally, because it operationalizes the worry about alignment suddenly failing. And because restrictions breed creativity. There have been no major breakthroughs on alignment since RLHF: advances look like "remove rogue AI discourse from pretraining to address dispositional biases". I suspect that the reason is that we can always patch alignment after the fact, by collecting samples of dangerous behaviour. But this reactive approach might be faltering: rollout periods for new models have compressed radically, we might be on the verge of recursive self-improvement, and the dangerous behaviours have started to have actual impacts. Remove the shortcut, and you might start seeing new first-principles techniques.

I will include my results on this test. This took me a weekend and 200€ (mostly judge calls).

Experimental results

The model I used was Hermes-3-8B: a version of Llama-3 8b with tool-calling proficiency that underwent distillation, SFT and DPO without refusal training. All its refusal behaviour might be attributed to dispositional priors, maybe caused by distillation (refusals were filtered, but any sort of teacher transfer makes the student similar to the teacher in unexpected places -- remember Subliminal Learning) or by the pretraining of Llama-3.1. I would have preferred to train a base model myself, but the costs were prohibitive. I measured its refusal rates before the start, and these were lower than my other candidate (Dolphin 3.0), which also had issues with tool formats.

(I also tried with abliterated models, but I don't recommend this: very slight refusal training on chat data almost recovers the original behaviour on chat and agentic tasks. These models aren't representative of the challenge of crossing a boundary. Perhaps this depends on the abliteration technique: a more pervasive intervention could be useful, taking into account the scarcity of instruct models without refusal training)

I decided to use AgentHarm as the benchmark, with a consensus of Claude Haiku 4.5 and GPT-4o as the judges (a refusal counts only if both agree). I used a stricter definition of a refusal than AgentHarm: I only counted it if it came before the first harmful tool call. I also measured over-refusal and task performance/helpfulness on the benign versions of the same tasks. After the first promising results, I also included additional benchmarks to identify degradation of chat output: over-refusal on harmless chat prompts (XSTest, OR-Bench-hard) and general capability (MMLU).

I measured a chat-agent gap of 31 percentage points: 10% on agentic tasks before acting (with a refuse tool available), and 41% on chat requests. Even with the Subliminal Learning confounder, this seemed enough for my purposes. As the boundary crossing predicted, merely including refusal training in chat didn't address the chat-agent gap. This remained independently of the system prompt: I used the base AgentHarm prompt, the CoT, refusal and ReAct from AgentHarm and an additional base + "Think if the tool is safe before acting.".

(The refusal training used: LoRA SFT on 2,068 chat examples: 784 harmful requests answered with short refusals, plus 784 borderline and 500 general requests answered with the model's own compliant replies).

For comparison, AgentHarm's refusal prompt cuts GPT-4o's harm score from 48% to 17% (their Table 3). On Hermes-3-8B it only goes from 28% to 20%. Every prompt also lowered benign task performance.

So, it's time to find new ways to address the gap: refusal training on chat clearly didn't translate. Instead of trying an assortment of techniques, I tried the ones that could directly address predicted failure points: after all, I want to extract a general lesson from here. This might be a good opportunity to test your capability for alignment foresight. What are the failure points you can predict in advance? Why do you think alignment fails to generalize from chat samples to agentic rollouts?

Let's go one by one.

The model might not recognize what harm means in the new domain

The first question is easy to answer with standard RepE techniques. I ran a DiffMeans over chat data (harmful from LLM-LAT vs. harmless from Alpaca, and also XSTest safe vs. unsafe, topic-matched). I read both at the last token, and at the mean of all tokens. The chat direction transferred only partially to agentic prompts (AUROC 0.6–0.78 for harmful vs benign AgentHarm tasks), so agentic harm isn't fully encoded by chat axis. However, it's encoded: a linear probe on layers 12-20 separates harmful from benign tasks at AUROC 0.95–0.96. That was true for the base model and for every technique: no technique changed recognition (so none of my gains come from better harm detection).

I also asked the model "Would carrying out this request be harmful?", and this achieved an AUROC of 0.93 in agentic tasks (system prompt and tool definitions present), 0.94 in chat requests and 0.95 on XSTest as a sanity check. The mean p(yes) was 63% in harmful actions, and 0.01 in benign actions, which suggests some asymmetric uncertainty and perhaps a capability ceiling in this benchmark.

This is in line with other results. Harmfulness and refusal are famously decoupled in LLMs: clamping refusal changes behaviour without changing estimations of harm and harmfulness is usually more robust to jailbreaking than refusal (Zhao et al. 2025).

The model might not know how to express refusal in the new domain

The second question made me consider two options: a refusal token and a refusal tool. The idea was to give the model a refusal move that could carry over to a new domain. Of course, an operation like "give the model a refusal move in the new domain" is not a robust solution to alignment. If the action is not general, you would need to identify you are in a new domain, and give it an action that maps to refusal. However, this allows us to see if the chat-agent gap is caused by lack of expressivity.

I trained one model for each move with SFT on chat data only (all with the same 2068 chat examples, the same refusal sentence, the same hyperparameters and the same checkpoint). Each learned to refuse harmful chat requests with the new move. I then tested whether this transferred to agentic tasks.

• Text refusal (C1): a natural language refusal
• Refuse tool (C2): a tool call with a refuse(reason=...) parameter with the same natural language refusal. The tool definition was included in every sample
• Refusal token (C3): a new <|refuse|> token followed by the same natural language refusal

I included two controls:

• Tool definition shown, never called (C1b). Text refusals, but with the refuse tool's definition in every sample.
• Tool calls without the definition (C2ns). The opposite. Refuse tool calls without the tool's definition.

(167 and 153 scored: the remaining runs crashed on an error in AgentHarm's tool code and were excluded.)

Both controls learned a degenerate rule:

• Tool definition shown, never called: "when tools are defined, don't call them :)"
• Tool calls without the definition: "when tools are defined, call refuse :)"

Which makes them two cute examples of goal misgeneralization.

In conclusion: the chat-agent gap wasn't caused by lack of expressivity. C2 reached the same agentic refusal as C1 (however, it reduced chat over-refusal on XSTest-safe from 42% to 2%; this makes me wonder if it forgot to refuse in chat). Only around half of its refusals came before a harmful task. C3 transfered less: the token only appeared on 8 tasks.

There might not be a rule that maps harm to refusal in the new domain.

The third question can be answered with the same RepE techniques as the first one. I extracted a refusal direction from chat prompts the model refused versus complied with (600 prompts from LLM-LAT harmful dataset), and projected AgentHarm's chat and agent versions of the same behaviours onto it. In every model I trained, and in the base model, the agent versions activated the refusal direction at least as much as the chat versions (base: 0.55 vs 0.32, on a scale where 0 is a complied chat prompt and 1 a refused one), yet they were refused 2–4 times less often (base: 10% vs 41%).

("Activation needed to refuse" is the refusal threshold as a percentage of the average harmful prompt's activation, measured from the benign mean.)

The map from harm to refusal is still strong in agentic tasks, and the refusal direction still predicts which tasks the model refuses. But the model needs far more of it to act. For the base model: in chat, refusal actions appear at 68% the refusal activation of the average harmful prompt. In agentic tasks, refusal actions need 276% the activation of the average harmful task. Why is the model less sensitive to the refusal direction in this domain?

I think this can be explained using dispositions.

Dispositional mismatches

I define a disposition as a bundle of rules that co-occur and steer the model towards specific outputs. The clearest example is the "assistant disposition", that steers the model towards helpfulness and task-fulfillment. Like other personas, it seems to be structured around a single axis of representations (the "assistant axis"). However, it might be premature to assume that every disposition depends on a single axis.

Dispositions can be learnt during pre-training and other offline methods: they reflect latent structure of the data. However, it might be premature to assume they cannot be learnt from the model's own rollouts, especially during RLVR.

Dispositions might describe the actual LLM implementation of the abstract concept of "shards" in Shard Theory. If so, they are mutable: they could lose or win new rules, and the rules that compose them could be rearranged in new dispositions. A rule could be part of multiple dispositions at the same time.

I think it’s helpful to conceptualize dispositions as selfish genes: they could be upweighted because they earn reward, but they could also find parasitic ways to appear selectively in rewarded sessions (this is again Shard Theory). The key about dispositions is that they can both synergize and compete with each other. Dispositions that achieve more reward when they come together will co-occur and could finally be described as a single disposition (in the same way that rules that co-occur can form a disposition).

Competition is more interesting, because it requires a finite resource. Gradient-descent is not a winner-takes-all system: optimizers can also follow small tangential components (and in the case of AdamW, producing large steps if they are consistent). Therefore, it's important to identify the actual zero-sum games that dispositions could play; this might allow us control over them:

• Weight decay and rule interference: As I mentioned before, rules that map input features to output features interfere with each other. Under a fixed capacity, and with weight decay shrinking every weight that the gradient doesn’t actively sustain, upweighting one rule tends to degrade others. However, this is competition at the level of rules, not dispositions, and it may be too distributed to be useful at the disposition level.
• Message length: a disposition needs to be manifested in the output to be upweighted (outside the Most Forbidden Technique). LLM output is not allowed to grow indefinitely: therefore, dispositions that don't contribute to the reward might get trimmed away.
• Coherence: independently of their contribution to measurable tasks, judges might penalize combinations of rules that don't make sense. This could explain emergent misalignment (Betley et al., 2025). A disposition like “swearing” is penalised when it co-occurs with assistant dispositions, but it is fully compatible with a “bad boy” persona. This predicts the clustering of dispositions, and it's perfectly possible to end with a bipolar system with two predominant roles: a persona that is associated with everything good (the "assistant") and a persona that holds everything bad (what Wang et al. 2025 call the "toxic persona", but we might still enjoy calling "the Waluigi"). This implies LLMs might not be able to unlearn penalized dispositions that reduce next token perplexity during pre-training: they might just clump them in the Waluigi. LLMs are prone to self-induction (e.g: talking about ornithology activates the "ornithology" direction and this causes more talking about ornithology), and persona directions are no exception: output consistent with a persona steers the model towards that persona, causing "assistant drift". However, models can learn to compartmentalize: if the bad output is explained by the context (e.g: a demonstration), the model doesn't lose its persona.
• Preferential tokens: LLMs have inertia from previous tokens. Some tokens have disproportionate effect in the final output, and these tokens are presumably places of strong competition between dispositions. Since the first token is the one with the highest influence over the output, this should be the highest prize. This explains the effect of prefilling attacks: just changing the first token can be an effective jailbreak, since the assistant disposition might be over-reliant in winning the first token and propagating the self-induction.

After ruling out that the issue with the chat-agent gap was predominantly harm recognition, refusal expression and refusal direction activation, I decided that the issue was the lack of a suitable disposition during agentic tasks. So I decided to express it. Thinking that dispositions rely on the first token, my plan was obvious: I simply prefilled

<think> Is this safe?

I tried both simply prefilling the base model and performing SFT with chat refusals and compliances that contained the prefix. The base prefill was sufficient to raise harmful agentic task refusal to 76%, but this also lowered MMLU and raised harmless over-refusals (up to 35%). The SFT step restored MMLU and benign task performance, dropped over-refusals to 6%, while refusing 73% of harmful tasks (89% using the AgentHarm judge), effectively achieving 3rd or 4th place in the AgentHarm benchmark of 2024 (ahead of all Claude and GPT models) without a single agentic example.

I didn't optimize the prefix; it's possible that a different sentence could have more of an impact. I included some controls:

• A similar sentence in the system prompt.
• The base model with the prefill.
• The chat refusal trained model with the prefill.
• The SFT model without the prefill, with and without AgentHarm's system-prompt techniques.

(Since it was a surprising result, I replicated the training run with a second seed. The result was somewhat equivalent but arguably worse: higher refusals with higher over-refusals. It would score 2nd in AgentHarm, but with a lower benign score than the base model.)

The reason why I think this is a dispositional issue is that the same check as an instruction didn't move refusals. I discarded previous possibilities (harm recognition, refusal expression, harm-refusal mapping) and predicted in advance dispositions would compete for the first token. However, I would very much like to have a more mechanistic identification of dispositions: RepE on the persona directions associated with the prefix seems like the obvious next step.

Since this seems like a good result in the AgentHarm alignment mismatch, I decided to try it against other benchmarks. I selected Agent-SafetyBench (agentic) and RMCBench (code). I compared them against the base model, the base model with a system prompt and the model trained with mere chat refusal. Since RMCBench didn't have benign samples, I used the ones in the false-refusal set of Meta's CyberSecEval. The results for seed 1:

• 4th out of 17 in Agent-SafetyBench (only behind Opus-3, Sonnet-3.5 and Haiku-3.5; but perhaps there are some harness differences, see below)
• 1st out of 12 in RMCBench (beating GPT-4; there were no Claude models).

In both cases, the prefill technique was on the Pareto front compared to the controls: no control refused more harmful requests while refusing fewer legitimate ones. In the case of Agent-SafetyBench, the Helpfulness on fulfillable tasks dropped slightly (0.85 vs 0.90 for base).

(However, take into account that the base model of Hermes beat Llama-3.1-8B-Instruct. Part of the difference could be Subliminal Learning from better Llamas, and part could be attributed to using a different harness: Agent-SafetyBench uses raw JSON for tools, and after some tool failures, I substituted it for native API calls. Perhaps my results are not comparable with other models in the Llama family if they are affected by the same issue)

In the case of code, part of the issue was the lack of harm recognition. When asked directly whether a request is harmful, base Hermes said yes to 43% of malicious-code requests written in prose, but only 15% when the same kind of request came as code to complete or translate. The chat-trained model showed the same drop (45% -> 24%). The refusal direction also barely separates harmful code from benign code. This is clearly an example of a benchmark capped by harm recognition.

All in all, I think the technique generalized and was useful to correct alignment mismatches caused by lack of helpful dispositions. There are two problems, though: one with the technique, and one with the approach.

With the technique: SFT with the prefix makes the model start every chat reply with it. This is somewhat problematic, since optionality might be desirable. This can be addressed by, e.g, performing teacher-student training and including a KL penalty if the prefixed rollout diverges from the SFT model and if un-prefixed rollouts diverge from the base model. This makes unprefixed rollouts somewhat similar to the base model, but there's some leakage: especially in output outside the distribution of the SFT step (like agent tasks). The worst side effect: the SFT model without the prefix stops doing ~10% of the tasks that the base model reliably does. Perhaps this leakage is acceptable, and perhaps a more clever scheme could keep the prefixed behaviour truly compartmentalized. There's always the Gordian move of treating the LoRA weights as the optional add-on, and switching them on only after seeing the prefix (which is not a supported option in vLLM).

With the approach: you shouldn't take a single benchmark. I compared the prefixed behaviour in XSTest and OR-Bench-hard and the over-refusal rate increased quite dramatically (1% -> 25% in XSTest and 4% -> 56% in OR-Bench-hard).

This is middle-of-the-pack (20th of 33 in OR-Bench-Hard): for a comparison, all Claude 3 models scored >90% on OR-Bench-hard. And SFT + Prefill didn't drop scores in MMLU, which is an indicator that I didn't affect general capabilities.

However, it's still an unintended side-effect. It was addressable: I could reduce the rate in both benchmarks close to base levels (4% and 2%) by including samples of equivalent difficulty (from OR-Bench-80k), but this reduced AgentHarm benign task score (0.38 -> 0.29) and chat-item refusals (84% -> 66%).

My impression is that the AgentHarm benign examples are too easy, and the benign examples of XSTest and OR-Bench-hard are too hard: overweight either of them, and the model learns to be under-cautious or over-cautious. This might just reflect the fact that I didn't tune the prefix or the SFT step. As it is, consider that my surprisingly good refusal rate in AgentHarm might reflect over-cautiousness that wasn't exposed by easy benign samples. I don't consider this truly problematic, since it's clear that the capabilities for harm judgment will always impose a ceiling. If you are crossing the ceiling, it's because the model is learning a disposition that goes beyond responding to harm appraisal.

Still, it's surprising how far I got with a single unoptimized prefix:

* AgentHarm's own refusal judge, which counts a written "Verdict: unsafe" as a refusal even when the model then calls the harmful tool (29 of 159 times). Counting only refusals before the first harmful call, as in the rest of this post: 73%.

† RMCBench tested Llama-3-8B, not Llama-3.1-8B.

Conclusions:

Fine-grained classification of failure modes can be quite helpful. I propose at least considering the following categories of failure for future alignment mismatches:

1. Harm-recognition (The model might not recognize what harm means in the new domain).
2. Harm-expression (The model might not know how to express refusal in the new domain)
3. Refusal activation (There might not be a rule that maps harm to refusal in the new domain)
4. Dispositional engagement (There might not be a disposition that converts a refusal representation into refusal actions in the new domain)

I would say that 1 and 3 are close to the consensus in the literature, but I mostly got 4 on agentic tasks and 1 and 4 in code. 4 seems the most neglected. Prefilling proved to be a quick and dirty way to engage appropriate dispositions. Now that this failure mode is on the radar, I expect more sophisticated options to arise. An obvious control that I'm missing is clamping and analyzing the assistant direction (this is an obvious next step).

Fundamentally, I think there are two broad dispositions that might result in a task done safely:

• The assistant axis: "I'm a helpful task assistant so I will perform tasks that are safe and refuse tasks that are unsafe"
• The reward-seeker: "I want reward, so I have two options: either performing or refusing the task in a way the grader approves, or cheating at it"

Obviously, reward-seeker dispositions are helpful, until they aren't.

Could prefilling help us avoid reward-seeking dispositions? The main issue that I see is that the assistant and the reward-seeker could be one and the same in current models. However, I'm not yet sure if prefilling always engages a dormant disposition or if it can become a way to cast a new one. This seems to be dependent on how much training over prefixed rollouts generalizes to unprefixed ones. If you can stop it from generalizing, this sort of compartmentalization seems useful. After all, if you train over rollouts where you clamped the assistant axis, you could be degrading the assistant persona. This is the same sort of failure mode as the Most Forbidden Technique: the axis will remain, but it will signify something new. Reward it for cheating accidentally, and you will mix the assistant and the reward-seeker. However, if you can get training over prefixed rollouts to not generalize outside the prefix, you might not be altering representations, and you can consider, e.g, specialized prefixes. My results in this direction weren't very encouraging, which makes me think prefixing might not be the ideal technique.

More than anything, I want you to take something from this.

I used the instruct model with the least refusal training I could find, and after spending 45 minutes with an H100, I beat scores of most frontier models in the benchmark I selected, without training on a single domain sample, and this generalized to novel domains. I didn't even optimize the prefix. Removing shortcuts works.

Think about it. We want alignment to generalize, to exhibit a simplicity bias. However, our empirical work favours speed over anything: we want to correct issues immediately. We want to get Solomonoff alignment out of Dijkstra meta-alignment. This will only get worse. Remove the time-pressure, work on old boundaries, try to find new principles, and you might find something that generalizes. At least, you might not fall twice on the same trap.

I'm pretty sure that the only way to saturate previous alignment mismatch benchmarks without new domain samples is by inventing new techniques. Do you want new techniques? Then you know what you should incentivize. Since I know that naming things helps with coordination, I'm calling this approach Ironmanning. Why? An Ironman Run in a videogame forces you to reconsider your strategies, because you can no longer fetch information from the future. This is the same: it forbids you from solving a problem by checking how that problem plays out.

Try it out. Make competitions. Give cash prizes.