category: training · status: draft · updated: 2026-11-02

Trajectories vs Writeups

A CTF writeup and an execution-verified trajectory describe the same hack. As training data they could not be more different.

A writeup is the story told after the fight: "Noticing the id parameter reflected unsafely, I fired sqlmap with --tamper=space2comment, retrieving the admin hash." Clean, linear, ~500 words, ending in the flag. A trajectory is the game tape: every tool call, every error message, the 404 where the shell should have been, the three payloads that did nothing, the moment the agent re-read the source, switched from boolean-based to time-based injection, and then got the oracle to flip. Same task, same flag — one teaches narration, the other teaches playing.

Why the difference changes what the model learns

The empirical anchor is Chu et al., SFT Memorizes, RL Generalizes (arXiv:2501.17161): supervised fine-tuning tends to memorize surface patterns from its targets, while reinforcement-learning-style training on outcome signal learns transferable rules. (Follow-up work has qualified the strong version — SFT on the right kind of data generalizes better than the slogan implies — which is exactly the point here.)

Writeups are almost pure surface. They compress the 40-step search into a 5-step story, because humans write for other humans who already know how to hack. The causal middle — what was tried, why it failed, what evidence triggered the pivot — is precisely what gets edited out. SFT on that corpus produces a model that narrates brilliantly: confident, well-structured, fluent… and helpless the first time the environment disagrees, because it has never seen a step whose output wasn't already implied by the previous sentence. Simbian's Cyber Defense Benchmark found exactly this failure shape at frontier scale: even the best of 32 models quit early and missed over half the evidence — narration without persistence.

Verified trajectories are still consumed by SFT, but they are behavior, not testimony. They carry the decision middle: full tool-call interleaving, real environment observations, dead ends, and the self-corrections that recovered from them. That's the substrate on which "RL generalizes" style learning can act — and it's what our fleet's rejection sampling harvests (see [[rejection-sampling-star]]).

What a good trajectory contains

Ours, following the CyberFactory pattern (arXiv:2608.23181) and CTF-Dojo (arXiv:2508.18370):

1. The full interleaving — model reasoning, tool call, environment response, next reasoning. Not summaries. (Up to our τ=0.9 context-compaction trigger, where the state is rewritten — verified evidence, failed attempts, open hypotheses — not the history lied about.)
2. Errors and self-corrections, kept in. A winner that recovered from a broken payload teaches recovery. Strip the failure and you've turned game tape back into a writeup.
3. The verification step — the agent runs the differential oracle (crash on pre-patch build, clean on post-patch), the flag check, the EVM assert. The model must learn that checking is part of the move, not an epilogue.
4. Terminal state + reward provenance — which checker passed, which container digests, so weekly decontamination and dedup can trust the label.

Worked example. Same stored-XSS task, two artifacts. Writeup version: 212 tokens, "the search param was injectable, payload stored, alert fired." Trajectory version: 38 steps — CSP header misread once, two dead img onerror attempts blocked by the sanitizer, pivot to SVG-based payload, oracle re-executed against pre/post containers, pass. Train on 10k writeups and the model produces lovely reports about XSS it never lands. Train on 500 trajectories and it flails productively — which is what actually solves the held-out eval.

The contamination bill for writeup corpora

Writeups don't just under-teach; they poison the exam.

• They contain the answers. Public CTF writeups literally include flags and solutions for the very benchmarks everyone evaluates on. CTFusion (KAIST, ICML 2026) showed static CTF benchmarks are contamination-inflated, and live-CTF evaluation is the robust alternative — which is why our weekly refresh and procedural randomization exist.
• The genre leaks, not just the flags. Writeup-English ("as we can see in the screenshot, the flag is…") is fingerprintable; a model trained on it will ace any test graded by an LLM judge that shares the dialect. Benchmark inflation without capability.
• Precedent: Amazon's Cyber-Zero (arXiv:2508.00910) synthesized trajectories from writeups via two-persona simulation — clever craft, +13.1% at the time — but it's a simulation of testimony, inherits the genre's missing middle, and ships CC-BY-NC (we don't touch NC licenses). Its sibling CTF-Dojo went the other way: real containers, 486 execution-verified trajectories, +11.6% — fewer points, but real ones, from ~7% of the data volume.
• Defense-in-depth for us: our held-out eval uses fresh procedural variants weekly; train/eval dedup is mandatory (the CyberFactory paper's own CVE overlap with CyberGym is the cautionary tale); writeup-derived material, where legally clean, goes at most into the DPO garnish for report style — never into capability SFT, and never unverified.

The one-sentence version: writeups teach the model how hacks sound; trajectories teach it how hacks happen — and only one of those survives contact with a fresh container.

Primary sources: Chu et al. 2025 · CyberFactory · CTF-Dojo · Cyber-Zero · CTFusion

See also: [[rejection-sampling-star]] · [[sft-vs-dpo-vs-grpo-vs-rlvr]] · [[cyberfactory-openaegis]] · [[landscape-2026]]