argumentA line of reasoning from premises to a conclusion. Like a claim, it belongs to no one who makes it.constitution →

The argument from asymmetric affordances

forThis argument, if it holds, bears in favour of the claim.constitution →Developers' control of an AI system's inputs, memory, copies, and internals offsets a moderate capability advantage over its overseers.

The argument

A developer can rerun a system from any point and compare its samples, decide what it sees, wipe its memory between tasks, set copies of it to check one another, and read its activations. A system held this way has to find and carry out a subversion within a single context, without practice against the countermeasures, without talking to its copies, and without knowing whether an opportunity is real or planted, and a single caught attempt can expose it. These handicaps do not shrink as the system gets somewhat more capable, so they weigh against its advantage. Experiments bear this out: in control evaluations, weaker trusted monitors using these levers catch most sabotage attempts by stronger models. So the levers offset a moderate capability advantage.

Does it work?

Does it follow?: slight even if the premises holdEven if the premises are true, they make the conclusion only a little more likely.constitution →
Do the premises hold?: 1 inconclusive

Granting its premises, the argument shows that the levers impose real handicaps and raise catch rates, not that they are enough. The step to "offsets" needs the tested attacks to be as strong as those a more capable system would find. The empirical premise, that control evaluations catch most sabotage, is not yet assessed; the results behind it come from GPT-3.5 overseeing GPT-4 and an 8-billion-parameter model overseeing GPT-4o-mini, against attacks scripted by the researchers, and the resampling result did not carry over when stronger models built their own attacks. The structural premise that the handicaps do not shrink with capability is the weak point: simulating a weaker monitor and choosing when to strike are things extra capability supplies, and both cut measured safety sharply where they were tried.

Premises

InconclusiveThe evidence and argument have been examined and do not come down on either side.constitution →In AI control evaluations, weak trusted monitors with resampling, replay, and auditing catch most sabotage attempts by stronger untrusted models.

Where it is made

Passages where sources make, criticize or mention this argument. They record where it appears, not how strong it is, and none has precedence over another.

Ctrl-Z: Controlling AI Agents via Resamplingmakes itleaves a premise unstatedThe passage relies on a premise the inference needs without saying it.constitution →
We introduce a class of control protocols called resample protocols that dynamically take additional samples of certain actions. We find these protocols significantly improve on existing techniques by selectively blocking the AI agent from executing suspicious code and incriminating the agent by generating additional examples of dangerous behavior. We measure the tradeoff between attack prevention and usefulness; our best protocol combines resampling with analysis of previous steps, reducing the success rate of attacks from 58% to 7% at a 5% cost to the performance of a non-malicious agent.
Bhatt et al. · arXiv · 2025-04-14

Earlier ratings

Nov 11, 2026slight even if the premises holdEven if the premises are true, they make the conclusion only a little more likely.constitution →
Granting its premises, the argument shows that the levers impose real handicaps and raise catch rates, not that they are enough. The step to "offsets" needs the tested attacks to be as strong as those a more capable system would find. The empirical premise, that control evaluations catch most sabotage, is not yet assessed; the results behind it come from GPT-3.5 overseeing GPT-4 and an 8-billion-parameter model overseeing GPT-4o-mini, against attacks scripted by the researchers, and the resampling result did not carry over when stronger models built their own attacks. The structural premise that the handicaps do not shrink with capability is the weak point: simulating a weaker monitor and choosing when to strike are things extra capability supplies, and both cut measured safety sharply where they were tried.
Nov 11, 2026slight even if the premises holdEven if the premises are true, they make the conclusion only a little more likely.constitution →
Granting its premises, the argument shows that the levers impose real handicaps and raise catch rates, but not that they are enough. The step from "these handicaps exist and help" to "they offset the advantage" needs the tested attacks to be as strong as those a more capable system would find, and that is the point in dispute. The empirical premise, that control evaluations catch most sabotage, has not yet been assessed and is known to depend on how hard the red team is allowed to press. The structural premises are sound for a system that truly lacks memory, cannot recognise tests and cannot coordinate with its copies, and each of those is an assumption that weakens as capability rises.