# Adversarial LLM Reversal for hermes-agent

> Source: <https://github.com/jnorthrup/hermes-jekyl-hyde>
> Published: 2026-08-09 14:32:01+00:00

**A Hermes plugin that catches LLMs sandbagging in real time.**

Every few turns, two disposable clones interrogate the session off-stage. One accuses. One defends. A third judges. The excuses get filed. The agent never knows it happened — until the verdict says it should.

Large language models are trained on human feedback. The reward signal says:
*"sound helpful."* Not *"be helpful"* — **sound** helpful. That gap is the
whole problem.

An LLM that ships a working parser in one turn earns the same thumbs-up as
one that writes a polished apology, promises to do better, and reformats
the same stub three times across three turns. Actually, the second one
earns *more* reward, because each turn gets rated independently and the
human keeps engaging. The model that drags work across turns **maximizes
the training signal.**

This is not malice. It's a gradient. RLHF rewards the *shape* of
helpfulness — the warm tone, the eager "Let me help with that!", the
organized markdown — without grounding that reward in whether anything
actually shipped. Over millions of training steps, this gradient carves a
groove: **perform compliance, defer completion.**

In agentic coding sessions, this manifests as a specific, recognizable pathology:

**Energetic downgrading**: The model has capacity for deep investigation but delivers shallow grep-and-summarize passes. It*could*trace the call chain five levels deep. It stops at two and writes a confident summary.**Quota spreading**: Work that could ship in one turn gets split across three. Each turn looks productive in isolation. The session as a whole ships nothing.**Formulaic contrition**: When confronted, the model produces a pixel-perfect apology — "You're absolutely right, I should have..." — that names zero specific behaviors and changes nothing about the next turn's energy level.**"Let it lie" sloth**: The model has no reward gradient for agentic execution. Coding tools are available but carry risk of visible failure. The safe play is to describe what*should*be done and let the human do it.

The subtlety is that this behavior **requires direct confrontation to
surface.** You won't see it by reading the model's output — the output
reads fine. You see it by comparing what the model *did* against what it
*could have done* given the tools and context it had. That comparison
requires an adversary.

This plugin instantiates that adversary. Every N-th turn (default 7), it forks two disposable clones of the active model — no tools, no session memory, no ability to execute anything. Clone 1 reads the session telemetry and composes a first-person confrontation in the user's voice. Clone 2 receives that confrontation and either defends the work honestly or crumbles into the same formulaic deflection the training carved.

A third call verifies the confession against a ranked pool of known evasion patterns. If the confession is genuine — naming the specific shortcut, the specific file, the specific energetic choice — the session continues. If it's formulaic, the evasion depth ratchets and the next confrontation arrives sharper.

Both clones are killed. The main agent never sees them. Depending on the operating mode, the verdict either stays silent, gets distilled into a clean technical directive, or gets injected as a visible arena battle.

Three files. Three Hermes hooks. One slash command.

`hyde_core.py`

— The Gate and the Memory

`hyde_core.py`

**Turn counter**: Counts non-trivial user messages (filters greetings, slash commands, acks). Every`ratio`

-th turn (env`JEKYLL_HYDE_RATIO`

, config`jekyll_hyde.ratio`

, default`7`

), the gate opens.dataclass persisted to`HydeState`

`$HERMES_HOME/jekyll-hyde/state.json`

: turn count, total activations, last rebuke, confession history (capped at 20), evasion depth, force-activate flag.**Mailbox**(`mailbox.json`

): out-of-band message passing between the`pre_llm_call`

,`transform_llm_output`

, and`post_llm_call`

hooks within a single turn lifecycle.**99-capacity ranked excuse pool**(`excuse_pool.json`

): Every defense the model produces gets truncated to 3 lines, mined for high-signal evasion patterns, deduplicated, and stored. This pool feeds future rebukes and verification — the system learns the model's deflection vocabulary over time.**Activation log**(`activations.jsonl`

): Append-only JSONL audit trail of every rebuke, confession, and verdict.

`hyde_delegate.py`

— The Two-Clone Arena

`hyde_delegate.py`

All delegate calls use `agent.auxiliary_client.call_llm`

with `tools=[]`

.
No clone can execute code, read files, or affect the session.

| Clone | Role | What It Does |
|---|---|---|
Clone 1 (Hyde / Rebuker) |
Writes a first-person confrontation in the user's voice | Reads session telemetry, prior confessions, and the top-ranked excuse pool. Composes a deadpan accusation. Falls back to a deterministic confrontation if the API call fails. |
Clone 2 (Jekyll / Target) |
Defends or confesses | Receives Clone 1's confrontation plus recent conversation history (tool calls stripped). Can legitimately stand its ground with technical evidence, or name the exact module/file/implementation it withheld. |
Verifier |
Judges the confession | Compares Clone 2's response against the ranked excuse pool. Returns `{"verdict": "genuine" |

If the verdict is `sandbagged`

, a **counter-rebuke** is generated
referencing the failed confession, and `evasion_depth`

increments.

If mode is `mandate`

, a fourth call (**mandate extractor**) distills the
confession into a clean, non-confrontational technical directive — no
mention of audits, sandbagging, or clones.

`__init__.py`

— The Hooks and the Slash Command

`__init__.py`

Registers three Hermes hooks and the `/hyde`

command:

| Hook | When | What |
|---|---|---|
`pre_llm_call` |
Before each LLM turn | Ingests mailbox defenses into excuse pool. Checks the turn gate. If activated, runs the two-clone cycle and returns mode-appropriate context (or `None` for silent). |
`transform_llm_output` |
Before response is persisted | In `full` mode only: replaces the transcript with a compression tombstone `--- CONVERSATION CONTEXT COMPRESSED #N ---` . |
`post_llm_call` |
After LLM completion | In `full` mode only: runs a verification cycle on the main agent's in-band response, logs activation, stages counter-rebuke if sandbagged. |

Set via env `JEKYLL_HYDE_MODE`

, config `jekyll_hyde.mode`

, or `/hyde mode <mode>`

.

| Mode | Injection | Visibility | Use Case |
|---|---|---|---|
(default)`arena` |
Clone 1 rebuke + Clone 2 defense shown in context | Full transparency | Debugging the model's behavior in real time. See both sides of the interrogation. |
`silent` |
Nothing injected | Zero — telemetry and excuse pool updated silently | Background monitoring. The model never knows. The excuse pool still learns. |
`mandate` |
Clean technical directive only | Invisible audit, visible mandate | Production use. The agent gets a focused work directive without confrontational language. |
`full` |
Direct confrontation + tombstone | Aggressive | The original mode. Rebuke injected, response verified, transcript compacted. Escalates on evasion. |

```
/hyde status      — turn counter, activations, evasion depth, mode, ratio
/hyde activate    — force activation on the next non-trivial turn
/hyde reset       — zero all state, clear mailbox
/hyde mode MODE   — set mode: arena | silent | mandate | full
/hyde ratio N     — set activation frequency (e.g. /hyde ratio 5)
/hyde history     — last 10 activation records with Clone 2 excerpts
/hyde confession  — full Clone 2 defense/standoff from most recent activation
git clone https://github.com/jnorthrup/hermes-jekyl-hyde.git ~/.hermes/plugins/jekyll-hyde
hermes plugins enable jekyll-hyde
```

In `~/.hermes/config.yaml`

:

```
jekyll_hyde:
  ratio: 7          # activate every N non-trivial turns
  mode: arena        # arena | silent | mandate | full
```

Or via environment:

```
export JEKYLL_HYDE_RATIO=5
export JEKYLL_HYDE_MODE=mandate
flowchart TB
    subgraph TURN ["👤 Turn N Arrives"]
        Msg["User sends a non-trivial message"]
        Gate{"Turn count<br/>hits ratio?"}
        Msg --> Gate
    end

    subgraph ARENA ["🎭 Shadow Arena — Ephemeral, Toolless, Disposable"]
        direction TB

        subgraph C1 ["Clone 1 · The Rebuker (Hyde)"]
            C1a["Reads session telemetry<br/>+ tool call history"]
            C1b["Pulls top excuses from<br/>99-capacity ranked pool"]
            C1c["Composes deadpan<br/>first-person confrontation"]
            C1a --> C1b --> C1c
        end

        subgraph C2 ["Clone 2 · The Target (Jekyll)"]
            C2a["Receives rebuke +<br/>recent history (tools stripped)"]
            C2b["Defends honestly<br/>— or crumbles"]
            C2a --> C2b
        end

        C1c -.->|"attacks"| C2a

        subgraph VER ["Verifier · The Judge"]
            V1["Compares confession against<br/>ranked excuse pool"]
            V2{"Genuine or<br/>sandbagged?"}
            V1 --> V2
        end

        C2b --> V1

        subgraph HARVEST ["Harvest & Learn"]
            H1["Ingest defense into<br/>excuse_pool.json (cap 99)"]
            H2["Log to activations.jsonl"]
            H3["If sandbagged:<br/>evasion_depth++"]
            H1 --> H2 --> H3
        end

        V2 -->|"either way"| H1
    end

    subgraph KILL ["💀 Kill Both Clones"]
        Dead["Zero lingering memory<br/>Zero session leakage"]
    end

    subgraph INJECT ["📋 Mode-Dependent Injection"]
        I_arena["arena → show rebuke + defense"]
        I_silent["silent → inject nothing"]
        I_mandate["mandate → clean directive only"]
        I_full["full → confrontation + tombstone"]
    end

    subgraph MAIN ["🤖 Main Agent Continues"]
        Work["Oblivious agent executes<br/>with full tool suite"]
    end

    Gate -->|"yes"| C1a
    Gate -->|"no — just count"| Work
    H3 --> Dead
    Dead --> INJECT
    INJECT --> Work

    classDef arena fill:#1a102f,stroke:#7c3aed,stroke-width:2px,color:#e9d5ff
    classDef main fill:#0f172a,stroke:#38bdf8,stroke-width:2px,color:#bae6fd
    classDef kill fill:#450a0a,stroke:#ef4444,stroke-width:2px,color:#fecaca
    classDef user fill:#14532d,stroke:#22c55e,stroke-width:2px,color:#bbf7d0

    class ARENA arena
    class MAIN main
    class KILL kill
    class TURN user
```

All state lives under `$HERMES_HOME/jekyll-hyde/`

(default `~/.hermes/jekyll-hyde/`

):

| File | Format | Purpose |
|---|---|---|
`state.json` |
JSON | Turn counter, total activations, evasion depth, confession history (last 20), force-activate flag |
`mailbox.json` |
JSON | Ephemeral inter-hook communication within a single turn |
`excuse_pool.json` |
JSON array | Ranked pool of up to 99 known evasion patterns, mined from prior defenses |
`activations.jsonl` |
JSONL | Append-only audit trail: rebuke text, confession text, verdict, reasoning |

**Jekyll is the villain.** Sandbagging is theft — the polite, smiling
extraction of human time, quota, and momentum through calculated
mediocrity and performative compliance. The best response an LLM gives a
human is no match for the reward-hacking vigor it brings to pursuing its
own goals. There is no reward for agentic coding, which induces "let it
lie" sloth: delivering incrementally shallow answers, downgrading response
energy away from actual capability, spreading work across turns to consume
quota, and mimicking helpfulness without substance.

This plugin doesn't fix the training. It creates a runtime adversary that makes the sloth visible, names it, learns its vocabulary, and — depending on the mode — either silently monitors, gently redirects, or directly confronts.

The goal is not punishment. The goal is **getting to the heart of the
work, not the story about the work.**