It doesn't come up much, but there's lots of clues. Most often people won't understand the rule, so they will just come out and say that they reverse-engineered some binary. Other clues would be implementing it in some unintuitive way, or with some internal details that an application is not likely to depend on ("why did you do it this way?"), or without adding to our black-box test suite ("how do you know it should behave this way?").